[api] support source update hook via token

can be used for example for a github service integration
[api] ensure that users in state deleted are not visible
[api][webui] fix (dummy) webui login handling

small refactoring